In this paper, we present a novel approach to automatically learn defender policies. We apply this approach to an intrusion prevention use case. Here, we use the term "intrusion prevention” as suggested in the literature, e.g. in [1]}. It means that a defender prevents an attacker from reaching its goal, rather than preventing it from accessing any part of the infrastructure.
